DMARC publishes your enforcement policy at _dmarc.domain: monitor only (p=none), quarantine, or reject. It also requires alignment — the visible From domain must match what SPF or DKIM validated, closing the loophole spoofers exploited.
A strict policy (p=reject) protects your brand from spoofing and signals serious mail hygiene — but deploy it only after SPF and DKIM verifiably pass for every legitimate sending path, or you will reject your own newsletters.
Frequently asked questions
What does p=reject mean for my own misconfigured mail?
Exactly what it says: receivers discard your mail when authentication fails — including legitimate messages sent through unsigned paths. Verify alignment first, then enforce.
Do I need DMARC if SPF and DKIM pass?
Yes — without DMARC, a spoofer can pass SPF/DKIM on their domain while displaying yours in From. DMARC’s alignment requirement prevents that.